Developed in-house with the sole purpose of enabling penetration testing and simplifying the whole lifecycle — from scoping and scheduling through to reporting and retesting.
Security Dashboard
See your entire security posture at a glance with a live risk score, severity breakdown and active assessment status. The dashboard consolidates findings from every module so you can prioritise the work that matters most.
We embed AI-assisted automation across Pentesys services to speed up testing and make continuous security assurance more affordable — without sacrificing the human validation that makes findings trustworthy.
From attack surface discovery to vulnerability scanning and report drafting, AI acceleration is included in every engagement — not an add-on.
Automated assessment runs continuously across your external surface, networks, applications and APIs, so coverage keeps pace with releases.
Qualified consultants review, triage and confirm every AI-generated result before it reaches you, so you only act on real risk.
By automating repetitive reconnaissance and scanning work, we keep consultant time focused where it matters — giving you continuous assurance at a sustainable cost.
Traditional penetration testing gives you a point-in-time snapshot. The Mirage Portal combines continuous testing, external attack surface visibility, remediation management and expert human validation in one platform.
The Mirage Portal combines human-led expertise, AI-assisted analysis and real-time reporting to give security teams ongoing visibility of cyber risk.
One intelligent platform covering exposure, testing, adversary simulation, governance, AI-assisted analysis and collaboration.
Discover internet-facing assets, identify exposed services and keep an up-to-date view of your external estate, with automated discovery backed by expert validation.
Move beyond annual tests with an always-available platform that manages testing, findings, remediation and retesting throughout the year.
Plan, manage and review sophisticated adversary simulation exercises from a single platform, with full visibility of objectives, progress and outcomes.
Centralise security findings, compliance evidence and risk management so you can demonstrate assurance across every framework you're measured against.
Accelerate security operations with AI-assisted insight that prioritises vulnerabilities, summarises findings and recommends remediation — always human-validated.
Direct communication between your internal teams and Pentesys specialists, with notifications and status alerts keeping everyone informed end to end.
The workflows, capabilities, coverage and deliverables behind Surface, Validate, Adversary and Assure.
External Attack Surface Management (EASM)
Continuously discover, inventory and monitor every internet-facing asset your organisation owns. Mirage Surface identifies exposures before attackers do, with automated discovery, risk scoring and real-time alerting.
Asset discovery
Subdomains, IPs, ports, CT logs, DNS
Tech detection
300+ fingerprints across frameworks & servers
Tech analysis
Version tracking, CVE correlation, risk scoring
Credential scanning
Breach databases, leaked password detection
Dark web
Forums, Pastebin, GitHub, Telegram monitoring
Multi-source subdomain enumeration via SecurityTrails, Certificate Transparency logs and DNS resolution, with automatic deduplication and normalisation.
Quick and full port scans with service identification, banner grabbing and protocol detection. Risk-scored exposure analysis for every open port.
300+ detection patterns across web servers, frameworks, CMS, CDN, analytics, cloud platforms and security tooling, with version-level vulnerability correlation.
Certificate health grading (A+ to F), expiry alerting, TLS version detection, HSTS checks and self-signed certificate identification.
Continuous scanning of breach databases for leaked credentials tied to your domains, with severity-rated alerts and breach source attribution.
Ongoing monitoring of dark web forums, paste sites, GitHub and Telegram channels for leaked credentials, data dumps and mentions of your organisation.
Penetration Testing as a Service (PTaaS)
Human-led penetration testing with a flexible credit-based model. Buy credits and test when you need — across web, API, mobile, network, cloud and more, with full lifecycle management from scoping to remediation.
Scope
Guided wizard, dynamic effort calculation
Allocate
Credits reserved, prerequisites collected
Auto-scan
Free Nessus & Acunetix scanning
Manual test
Human-led validation & exploitation
QA & report
Internal QA, findings released
Remediate
Track fixes, retest when ready
Full finding lifecycle with CVSS scoring, CWE/CVE tracking, evidence attachments and severity-based prioritisation through a Draft → QA → Open → Fixed workflow.
Built-in Nessus and Acunetix integration. Automated scans are free — only human validation consumes credits — and scan findings flow straight into the pentest workflow.
A scoping questionnaire drives automated effort calculation using per-unit, range and boolean factors, with 15% planning overhead built in and manual adjustment supported.
Structured collection of VPN access, credentials, test accounts and API documentation, with an approval workflow that guarantees readiness before testing starts.
Attach screenshots, logs, HTTP requests/responses and code snippets to every finding, with inline viewing, captions and descriptions for clear communication.
Schedule continuous testing weekly, monthly, quarterly or annually, with occurrence tracking and comparison analytics across test cycles.
Red Team as a Service (RTaaS)
Full-spectrum adversary simulation with MITRE ATT&CK mapping, kill chain tracking and detection validation — measuring your SOC's ability to detect and respond to real-world threat actors.
Recon
Target research and intelligence gathering
Weaponise
Tooling and payload preparation
Deliver
Initial access attempts
Exploit
Execution and privilege escalation
Install
Persistence establishment
C2
Command and control channels
Actions
Objectives on target
Full 14-tactic ATT&CK matrix integration. Every technique and sub-technique is mapped to the framework with execution status, detection indicators and evidence.
Measure SOC effectiveness in real time, tracking Mean Time to Detect and Respond across 11 detection sources including SIEM, EDR, NDR, IDS/IPS and WAF.
Chronological attack narrative with kill chain phase assignment, outcomes, target systems and operator tracking — a full audit trail of every action taken.
Define up to five campaign objectives from 50+ templates across seven categories, tracked with evidence, success criteria and priority levels.
Eight pre-built attack scenarios from ransomware to APT to purple team. One-click loading populates techniques with full ATT&CK mapping.
Formal approval workflow with scope definition, ROE documentation, kickoff scheduling and contract reference, under a state-controlled campaign lifecycle.
Compliance & Assurance
Fixed-scope, expert-led compliance engagements covering Cyber Essentials, Cyber Essentials Plus, PCI-ASV quarterly scans and ISO 27001 readiness. Every engagement is structured, transparent and delivered through the Mirage portal.
Scoping & proposal
Scope defined, deliverables agreed, fixed-price proposal — no hidden fees
Assessment & evidence
Requirements tracked in portal; you upload evidence, we assess each control
Remediation & delivery
Gaps identified with clear advice, plus reports, certificates and submission packs
Real-time compliance progress tracking across all active engagements with per-framework breakdowns and status indicators.
Every requirement mapped, categorised and tracked to completion, with pre-loaded templates for CE, CE+, PCI-ASV and ISO 27001.
Upload, review and manage evidence linked to specific requirements, with files tracked by status, reviewer notes and audit trail.
Direct feedback from assessors with per-requirement remediation guidance, compliance status and priority indicators.
Reports, gap analyses, certificates and submission packs delivered through the portal with version tracking.
A full audit trail of every action taken during the engagement — evidence uploads, status changes, assessments and deliveries.
Centralise evidence, map findings to controls and produce audit-ready reporting across every standard in scope.
Continuous assurance against Annex A controls
Simplify evidence collection and tracking
Manage remediation and verification activities
Support operational resilience and compliance
Manage threat-led red team assessments
Track vulnerabilities and compliance requirements
Align findings to prioritised security controls
Evidence continuous monitoring for auditors
Push findings, remediation tasks and reporting straight into the ticketing, identity and collaboration tools your teams already live in.
Findings, assets and remediation flow straight into the scanners and workflow tools your teams already run.
Enable your clients to access CREST-aligned penetration testing, red teaming and continuous AI-assisted validation — delivered under your brand, with your reporting and your SLAs.
Continuously assess your security posture through an ongoing, managed testing service tailored to your environment — with ease and flexibility.
Move beyond point-in-time tests to ongoing, adaptive assurance.
Test on your terms. No rushed fixes driven by a fixed test date.
Every AI-assisted finding is validated by a qualified consultant.
Buy testing capacity once, then spend it as your programme evolves.
Manage scope, progress, findings and retests in one place.
Define assets, test types and objectives in the portal.
Human-led testing supported by AI coverage.
Live findings with actionable remediation guidance.
Validate fixes as soon as they ship.
Track posture and exposure between engagements.
“Our mission is continuous penetration testing — enabling businesses to evolve from static, point-in-time tests. Assurance is the key, not just testing.”
James Hinton · Founder
“Pentesys has continuously produced excellent work. Their group demonstrated extraordinary technical proficiency by spotting crucial flaws and offering clever fixes that greatly strengthened our security stance. Their meticulous approach and attention to detail ensured that every facet of the project was covered in full.”
CREST-registered testing delivered through a flexible PTaaS model — designed to fit your environment, risk profile and internal teams.
